1. General

The Residential Tenancies Board (the “RTB”) is committed to protecting all personal and special categories of data (also referred to as sensitive personal data) held about you.

Please take the time to read this Privacy Statement as it explains how we collect, use and store your personal data, and the rights you have in relation to the protection of your personal data.

Please note that we reserve the right to update this Privacy Statement as required.

1.1 Residential Tenancies Board Information

The RTB is a statutory body responsible for (but not limited to) the operation of a national registration system for all residential tenancies, the operation of a dispute resolution service, the provision of both information and policy advice, and completion of research regarding the private rented sector.

You can find more information on our statutory mandate under Section 151 of the Residential Tenancies Act 2004 (RTA) which can be located on the following website: http://www.irishstatutebook.ie

The RTB is the data controller of personal data we collect, or which is collected on our behalf about you relating to our statutory functions referred to above.

If you wish to locate further information on us, this can be done through our website, which can be accessed using the following link: https://www.rtb.ie/

1.2 Legislation

All data processed by the RTB is processed in accordance with applicable Irish data protection and privacy laws and the General Data Protection Regulation (‘GDPR’) to ensure we properly protect your personal data.

1.3 Queries and Complaints

If you are unhappy with the way we handle your personal data and wish to complain or if you simply require further information about the way your personal data will be used by the RTB, please contact us using the details outlined below:

We will take all appropriate technical and organisational steps to safeguard your personal data. In the unlikely event of a data breach, we will contact you in line with our legal obligations.

2. How do we collect information?

We collect personal data to provide our services to you. This data may be collected directly through RTB staff, the RTB website, any applications used by us, or indirectly through a third-party service provider on our behalf.

The following non-exhaustive methods of data collection are an indication of ways in which we may obtain your information:

Obtain personal information directly from you, your legal representatives or any other representative on your behalf.

Obtain information from third parties which may include anyone relevant to legal proceedings such as neighbours, agents, landlords, tenants, witnesses, legal firms, legal representatives, letting management companies, or through third-party service providers such as recruitment consultant agencies, customer service providers, public relations agencies, software service providers.

Publicly available information obtained through online searches including rental and property websites, media outlets such as newspapers or news websites, and state and/or industry registers.

Through data sharing (as provided for under the RTA, 2004 (as amended) between Government departments, agencies, bodies, investigatory bodies, local authorities, housing bodies, or the Gardaí.

Through queries from various stakeholders of the RTB which include members of the Oireachtas, the general public, or the media.

When entering our premises, you may be recorded on CCTV surveillance and the Visitor log (sign in/out) book for security purposes.

It is important that the information you provide to the RTB is up to date and accurate. As outlined in Section 7.2 of this statement, if the personal data we hold on you is inaccurate or incomplete, please contact us and we will endeavour to update the data as required.

Please be aware that it is our aim to collect only personal data which is required to perform a task in relation to you. In this regard, please do not provide us with information that is ancillary to these requirements.

3. What do we use information for?

3.1 Process and Lawful Basis

We use personal data collected to fulfil our mandate under the RTA, 2004 (as amended). However, we may use personal data we gather for any of the following purposes:

Process

Purpose

Lawful Basis for Processing

Identity Verification

To verify your (or your authorised representative’s) identity in any interactions between the RTB and you (or your authorised representative), whether in person, on the telephone, online, or in any other necessary circumstances.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Evidence Submissions

To gather information for dispute resolution services and legal proceedings.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Dispute Assessment

To determine the need for dispute resolution services or legal proceedings.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a task carried out in the public interest.

Court Decision and Determination Order Publishing

To provide information about Court Decision and Determination Order Publishing

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Recruitment

To recruit and assess prospective employees.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Security of premises and individuals on the RTB

For the security, and health and safety, of individuals on RTB premises.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a task carried out in the public interest.

Regulatory Compliance

To comply with financial regulations and any other relevant laws and regulations.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Process

Purpose

Lawful Basis for Processing

Tenancy Registrations

To register tenancies in the form of the Public Register.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Back-ups

To store personal data and make back-ups of that data in case of emergencies and for disaster recovery purposes.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

Administer Services

To manage and administer any services offered by us, including contacting you.

Processing is necessary for compliance with a legal obligation to which the controller is subject.

3.2 Special Categories of Data

Where special category data is processed by us for any of the purposes specified above, we will only use the information in the performance of the following functions:

As part of legal or dispute resolution proceedings.

As part of industry research (data is anonymised).

To respond to any queries, complaints, or requests received.

Where we process special categories of personal data, we will only do so for compliance with a legal obligation to which we are subject.

3.3 Not Providing Information

If you do not provide us with all the information we require, the resulting action may be that we are not able to fully offer you our services.

Furthermore, some services provided by the RTB require certain categories of information, without which, we may not be able to provide you with our service. For example, when registering a tenancy, we will require specific property details and occupancy details.

3.4 Call Recordings

We may record or monitor telephone calls to quality check and improve our processes and services and to improve client satisfaction.

4. Who do we share information with?

We may share personal data with other parties in the course of our duties. When this is done, we adhere to the following principles:

The transfer is based on a legal obligation or the performance of a contract.

Where data is transferred to another party, we ensure appropriate technical and organisational safeguards are in place to protect your personal data.

Where we engage a third party to provide a service to us, we require them to take appropriate steps to protect your personal data, and only to use the personal data for the purpose of performing those specific services.

While the parties we engage may change occasionally, we believe it is important you are aware of the types of parties we share data with. The categories and types of third parties outlined below is a non-exhaustive list but provides an indication of the parties we share data with.

4.1 Your Representatives

These may include any party you have provided permission for us to contact (such as next of kin or spouse), representatives associated with your tenancy (such as legal representatives or agents involved in your dispute) or other third parties associated with you (such as letting management companies).

4.2 Our Representatives

These may include RTB representatives such as employees, agents, contractors, legal representatives, Board, Adjudicators, Mediators and Tribunal Members.

Our representatives may also include companies who provide services in relation to recruitment, customer service, postage, data storage and archiving, IT and IT security, making and receiving payments, finances, data analysis, advertising, query and complaints management, and call quality assurance.

4.3 Other Third Parties

Third parties for the purposes of carrying out our function, i.e. case parties, insurance, internal and external audits, carrying out industry research, third parties who may improve our processes and services (such as consultants).

4.4 Government Departments, Bodies or Agencies

The RTB is legally obligated to share personal data with state actors as outlined under the RTA, 2004 (as amended).

Recipients of this data include Government departments (i.e. Department of Employment Affairs and Social Protection, agencies (i.e. Revenue Commissioners), bodies, investigatory bodies, local authorities, the Gardaí and members of parliament (upon request and on a case by case basis).

4.5 Sharing Between Our Departments

To perform our duties, we may need to share information among our internal departments. The following is a non-exhaustive list of circumstances in which information sharing across internal RTB departments may be required:

Corporate Services may share information with any relevant RTB department upon receipt of queries, complaints, or requests.

Finance may exchange financial details while making or receiving payments.

Registrations may share data on a case by case basis to verify tenancy registrations and for dispute resolution services and legal proceedings.

Information may be shared with Communications & Research to develop the Rent Index, the Public Register, and sector research, reports, and publications.

Various departments may share information to verify the accuracy of information held.

Various departments may share information to verify the tenancy addresses for the purposes of correspondence.

4.6 International Transfers

We may transfer your personal data (including special categories of personal data) outside of Ireland and the European Economic Area (EEA) to other companies set out in this Section 4, IT providers and other suppliers. The EEA comprises those countries that are in the European Union (EU) and some other countries that are considered to have adequate laws to ensure personal data is protected.

When transferring your personal data outside of Ireland or the EEA, we will (and will ensure that service providers acting on our behalf agree to) protect it from improper use or disclosure and ensure the same levels of protection are in place as are applied within Ireland and the EEA.

5. What type of information is collected?

To fulfil our statutory obligations and perform duties as outlined in this Privacy Statement, we will collect and process various types of personal data.

While the type of personal data may change occasionally, we believe it is important you are aware of the types of personal data we gather and use. The following table is a non-exhaustive list and provides an indication of the categories and types of personal data we use to perform our duties.

Please note that information listed under one category may be used for the performance of a task or in relation to activities under another heading or as outlined under Section 3.

6. How long do we retain information?

We will keep your personal data for as long as it is necessary to fulfil the purposes for which it was collected as described above and in accordance with our legal and regulatory obligations. This may mean that some information is held for longer than other information. The criteria we use to determine data retention periods for personal data includes the following:

Retention in case of queries; we will retain it for a reasonable period after the relationship between us has ceased;

Retention in case of claims; we will retain it for the period in which it may be enforced (this means we will retain it for 10 years in some instances); and

Retention in accordance with legal and regulatory requirements; we will consider whether we need to retain it after the period described above because of a legal or regulatory requirement.

7. What are your rights?

As a data subject, you will have the following rights, as outlined in this section. However, restrictions may apply in certain situations, i.e. documentary evidence submissions.

7.1 Right of Access (Article 15)

You have the right to:

receive confirmation from us that your personal data is being processed;

access to your personal data; and

certain other details in relation to how we use your personal data (which is generally included in this Privacy Statement anyway).

You can request copies of paper and electronic records (including recorded calls, where applicable) about you that we hold, share or use. To deal with your request, we can ask for proof of your identity and enough Personal Information about you to enable us to locate the Personal Information you have requested.

When requesting this information, we would be grateful if you could please complete a Subject Access Request Form which can be found at www.rtb.ie

When submitting your request, please provide us with information to help us verify your identity, such as a photocopy of your passport and utility bill and as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

Please note that an access request is free of charge, however, where we determine a request to be unjustified or excessive, we may charge you a reasonable fee.

7.2 Right to Rectification (Article 16)

You have a right to request that the personal data held in relation to you is up to date and accurate.

Where information is inaccurate or incomplete, you may contact us to request for the information to be rectified. Upon receipt of request, we will endeavour to ensure that the personal data is rectified and as up to date as is reasonably possible. Please note, in some circumstances requests may not be granted and if this occurs we will let you know.

As the RTB is a quasi-judicial body, the right to rectification of documentary evidence submissions does not apply.

7.3 Right to be Forgotten (Article 17)

You have the right to seek the erasure of personal data relating to you in the following circumstances:

The personal data is no longer required for the purposes for which is was obtained.

Where data is being processed on the basis of consent and you withdraw such consent to the processing and no other lawful basis exists.

The personal data is being unlawfully processed.

You object to the processing of personal data and there are no overriding legitimate grounds for the processing.

Your personal data requires deletion in line with legal requirements.

However, we will be unable to fulfil an erasure request if the processing of personal data is necessary for the following:

Exercising the right of freedom of expression and information.

Compliance with a legal obligation or for the performance of a task carried out in public interest.

Reasons of public interest in the area of public health.

Archiving or statistical purposes in the public interest.

The establishment, exercise or defence of legal claims.

Please note that the primary legal basis for our processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended), while additional processing activities are primarily carried out for dispute resolution or legal proceedings. In this regard, some processing in relation to your data may not be subject to the right to erasure.

To determine the validity of your request for erasure in line with the associated RTB processing activity, we will carry out an assessment of the justification for retaining your personal data where a legal requirement applies and contact you if we are unable to fulfil your request.

Please be aware that in certain circumstances we may need to retain some information to ensure your preferences are respected in the completion of our duties.

7.4 Right to Restriction (Article 18)

You have the right to restrict the extent of personal data processed by us in circumstances where:

You believe the personal data is not accurate, in which case we have to restrict any processing while we verify the accuracy of your personal data.

The processing of the personal data is unlawful but you wish to restrict the processing of data rather than erase it.

Where the personal data is no longer required by the RTB but you require the retention of the data for the establishment, exercise, or defence of a legal claim.

You have a pending objection to the processing of your personal data.

When processing is restricted, your personal data will only be processed:

with your consent;

for the establishment, exercise or defence of legal claims;

for the protection of the rights of other people; or

for reasons important to public interest.

We will contact you to confirm where the request for restriction is fulfilled and will only lift the restriction after we have informed you that we are doing so. Please note, in some circumstances requests may not be granted, i.e. processing of personal data for enforcement proceedings cannot be restricted as it is necessary for compliance with the RTA 2004 (as amended).

7.5 Right to Data Portability (Article 20)

The right to data portability only applies:

to personal data you’ve provided to us (i.e. not any other information),

where we are processing your personal data because you have provided your consent for us to do so, or under a contract with you; and

when processing is carried out by automated means.

Please be aware that our primary legal basis for the processing of personal data is on the basis of a legal obligation, as outlined under the RTA, 2004 (as amended). As such, we carry out minimal processing of personal data on the basis of a contract or on the provision of consent by the data subject and do not currently carry out any fully automated processing of personal data. The right to data portability will most likely apply in very limited circumstances.

7.6 Right to Object (Article 21)

You have the right to object at any time to the processing of your personal data concerning you which is undertaken on the basis of public interest or legitimate interest by us.

Please be aware that the primary legal basis for our processing of personal data is on the basis of a legal obligation as outlined under the RTA, 2004 (as amended). We have minimal reliance on Public Interest and no reliance on Legitimate Interest as a lawful basis for the processing of your data. The right to object will most likely apply in very limited circumstances.

If you wish to object to the processing of data, please contact us with your request. We will then stop the processing of personal data unless it is required for legal proceedings.

Please note that if you request that the RTB stop processing your personal data, we may be unable to provide you with our services.

7.7 Right not to be subject to Automated Decision Making, including Profiling (Article 22)

Please be aware that we do not currently carry out any fully automated decision making or profiling using personal data. You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you.

7.8 Where do I send requests?

Please send all your requests to the contact details provided in Section 1, with as much detail as possible about your requirements to allow us to deal with your request efficiently. To answer your request, we may ask you to provide identification for verification purposes.

7.9 How long will a request take to complete?

Upon receipt of a request, we will comply with the request within the statutory timeframe provided for in the GDPR. If we require more time to deal with your request, we will notify you of the delay, and the factors resulting in the delay. If we refuse your request, we will notify you within the relevant statutory timeframe accompanied by the reason for refusal.

We will not charge a fee for any requests, provided we do not consider them to be unjustified or excessive. If we do consider these to be unjustified or excessive, we may charge a reasonable fee (also applicable for multiple copies) or refuse the request.

You are entitled to contact the Office of the Data Protection Commissioner if you have any complaints in relation to the enforcement of your rights.

8. Our Communications

We may contact you occasionally for information regarding certain aspects of your dealings with the RTB.

This contact will relate to the purposes referred to in this Privacy Statement and may include the following:

As part of dispute resolution services and legal proceedings.

To gather information to provide sector research, reports, and publications.

To respond to requests, queries, or complaints.

The RTB will endeavour not to contact you outside of usual business working hours.